Lambda Compute Platform Should Not Use Default Deployment

More Info:

Ensure Lambda compute platform is not using default configuration

Risk Level

Medium

Address

Operational Excellence, Performance Efficiency, Reliability, Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To fix “Lambda compute platform should not use default deployment configuration” you need to change the CodeDeploy deployment configuration used for your Lambda application (often triggered from CodeBuild/CodePipeline). This is done in CodeDeploy, not directly in CodeBuild, but it will remediate the issue for builds that deploy Lambdas.

Below are the console steps.

1. Identify the Lambda deployment group used by your build

In the AWS Management Console, go to CodePipeline (if you use it) or check your CodeBuild project’s buildspec to see how deployments are triggered.
Note the CodeDeploy Application and Deployment Group used for Lambda deployments.
- In CodePipeline:
  - Open CodePipeline → select your pipeline → look at the Deploy stage → note the Application name and Deployment group (they will have Compute platform: Lambda).
- Or directly in CodeDeploy:
  - Go to CodeDeploy → Applications → look for applications with Compute platform = Lambda.

2. Change the deployment configuration for the Lambda deployment group

In the console, open CodeDeploy.
In the left menu, choose Applications.
Click the Lambda application that corresponds to your deployment.
In the application details, select the Deployment group you identified.
At the top-right of the deployment group page, choose Edit.
In the Deployment settings section, locate Deployment configuration.
Change it from the default (often CodeDeployDefault.LambdaAllAtOnce) to a safe traffic-shifting configuration, for example:
- CodeDeployDefault.LambdaCanary10Percent5Minutes (10% first, wait 5 minutes, then 90%)
- or CodeDeployDefault.LambdaLinear10PercentEvery1Minute
  Choose based on your risk tolerance and rollout requirements.
Review the rest of the settings, then click Save (or Update deployment group).

3. Confirm future builds use the new configuration

If using CodePipeline, confirm the Deploy stage references the same deployment group you just edited (no changes needed if it does).
If your CodeBuild project triggers CodeDeploy directly (via aws deploy create-deployment in buildspec.yml), verify that:
- The deploymentGroupName you pass is the updated deployment group, and
- You are not overriding deploymentConfigName in the command. If you do, set it to the same non-default configuration, for example:
```
aws deploy create-deployment \
  --application-name MyLambdaApp \
  --deployment-group-name MyLambdaDG \
  --deployment-config-name CodeDeployDefault.LambdaCanary10Percent5Minutes \
  ...
```

After these changes, deployments originating from CodeBuild/CodePipeline will no longer use the default Lambda deployment configuration and will instead use a safer canary/linear strategy.

Using CLI

You fix this by creating a custom CodeDeploy deployment configuration for the Lambda compute platform and then updating your deployment group (used by CodeBuild/CodePipeline) to use that config instead of the default.

Below are the minimal AWS CLI steps.

1. Create a custom Lambda deployment configuration

Example: linear 10% every 1 minute.

aws deploy create-deployment-config \
  --deployment-config-name MyLambdaLinear10PercentEvery1Minute \
  --compute-platform Lambda \
  --traffic-routing-config '{
    "type": "TimeBasedLinear",
    "timeBasedLinear": {
      "linearPercentage": 10,
      "linearInterval": 1
    }
  }'

Other valid type options: AllAtOnce, Canary, TimeBasedLinear.
Adjust linearPercentage and linearInterval to your needs.

2. Find your existing Lambda deployment group

List deployment groups for your Lambda application:

aws deploy list-deployment-groups \
  --application-name MyLambdaApplication

Note the name of the target deployment group, e.g. MyLambdaDG.

3. Update the deployment group to use the custom config

aws deploy update-deployment-group \
  --application-name MyLambdaApplication \
  --current-deployment-group-name MyLambdaDG \
  --deployment-config-name MyLambdaLinear10PercentEvery1Minute

This replaces the default (e.g. CodeDeployDefault.LambdaAllAtOnce) with your custom configuration.

4. Ensure your build/pipeline uses this deployment group

If CodeBuild is part of a CodePipeline:

Confirm the pipeline’s deploy stage is pointing to MyLambdaDG.
If needed, update CodePipeline via CLI:

aws codepipeline get-pipeline --name MyPipelineName > pipeline.json
# Edit pipeline.json locally so the CodeDeploy action uses MyLambdaDG
aws codepipeline update-pipeline --cli-input-json file://pipeline.json

After this, deployments triggered from CodeBuild/CodePipeline will no longer use the default Lambda deployment configuration.

Using Python

For Lambda deployments, this setting is controlled by AWS CodeDeploy, not CodeBuild. The misconfiguration means your Lambda deployment groups are using the default Lambda deployment configuration (usually CodeDeployDefault.LambdaAllAtOnce) instead of a canary/linear or custom config.

Below are step‑by‑step remediation instructions using Python (boto3).

1. Prerequisites

Python 3.x
boto3 installed:
```
pip install boto3
```
AWS credentials configured (via aws configure, environment variables, or an IAM role).

2. Identify Lambda deployment groups using the default config

import boto3

codedeploy = boto3.client("codedeploy", region_name="us-east-1")  # adjust region

def list_lambda_groups_using_all_at_once():
    bad_groups = []

    # List all CodeDeploy applications
    paginator = codedeploy.get_paginator('list_applications')
    for page in paginator.paginate():
        for app_name in page['applications']:
            # Filter only Lambda compute platform applications
            app_info = codedeploy.get_application(applicationName=app_name)
            if app_info['application']['computePlatform'] != 'Lambda':
                continue

            # List deployment groups for this app
            dg_paginator = codedeploy.get_paginator('list_deployment_groups')
            for dg_page in dg_paginator.paginate(applicationName=app_name):
                for dg_name in dg_page['deploymentGroups']:
                    dg_info = codedeploy.get_deployment_group(
                        applicationName=app_name,
                        deploymentGroupName=dg_name
                    )
                    config_name = dg_info['deploymentGroupInfo']['deploymentConfigName']
                    if config_name == 'CodeDeployDefault.LambdaAllAtOnce':
                        bad_groups.append((app_name, dg_name, config_name))

    return bad_groups

if __name__ == "__main__":
    bad = list_lambda_groups_using_all_at_once()
    for app, dg, cfg in bad:
        print(f"Application: {app}, DeploymentGroup: {dg}, Config: {cfg}")

This tells you which Lambda deployment groups are misconfigured.

3. Choose a safer deployment configuration

Use a built‑in safer config, for example:

CodeDeployDefault.LambdaCanary10Percent5Minutes
CodeDeployDefault.LambdaCanary10Percent15Minutes
CodeDeployDefault.LambdaLinear10PercentEvery1Minute
CodeDeployDefault.LambdaLinear10PercentEvery2Minutes
CodeDeployDefault.LambdaAllAtOnce (what you want to avoid)

If you don’t need a custom one, pick one of the above and skip to step 4.

3a (Optional). Create a custom Lambda deployment configuration

Example: 20% canary, 10 minutes bake time.

import boto3

codedeploy = boto3.client("codedeploy", region_name="us-east-1")

response = codedeploy.create_deployment_config(
    deploymentConfigName='LambdaCanary20Percent10Minutes',
    computePlatform='Lambda',
    trafficRoutingConfig={
        'type': 'TimeBasedCanary',
        'timeBasedCanary': {
            'canaryPercentage': 20,
            'canaryInterval': 10  # minutes
        }
    }
)

print("Created deployment config ARN:", response['deploymentConfigId'])

Note the name LambdaCanary20Percent10Minutes; you’ll use it in step 4.

4. Update deployment groups to use a non‑default config

Here we’ll switch all groups currently using CodeDeployDefault.LambdaAllAtOnce to, for example, CodeDeployDefault.LambdaCanary10Percent5Minutes (or your custom config).

import boto3

TARGET_CONFIG = "CodeDeployDefault.LambdaCanary10Percent5Minutes"
# or "LambdaCanary20Percent10Minutes" if you created a custom one

codedeploy = boto3.client("codedeploy", region_name="us-east-1")

def remediate_lambda_deployment_groups():
    paginator = codedeploy.get_paginator('list_applications')
    for page in paginator.paginate():
        for app_name in page['applications']:
            app_info = codedeploy.get_application(applicationName=app_name)
            if app_info['application']['computePlatform'] != 'Lambda':
                continue

            dg_paginator = codedeploy.get_paginator('list_deployment_groups')
            for dg_page in dg_paginator.paginate(applicationName=app_name):
                for dg_name in dg_page['deploymentGroups']:
                    dg_info = codedeploy.get_deployment_group(
                        applicationName=app_name,
                        deploymentGroupName=dg_name
                    )
                    current_cfg = dg_info['deploymentGroupInfo']['deploymentConfigName']

                    if current_cfg == 'CodeDeployDefault.LambdaAllAtOnce':
                        print(f"Updating {app_name}/{dg_name} from {current_cfg} to {TARGET_CONFIG}")
                        codedeploy.update_deployment_group(
                            applicationName=app_name,
                            currentDeploymentGroupName=dg_name,
                            deploymentConfigName=TARGET_CONFIG
                        )

if __name__ == "__main__":
    remediate_lambda_deployment_groups()

Run this once for each region where you have Lambda+CodeDeploy.

5. Ensure future deployments don’t revert to default

Wherever you start deployments (CodePipeline, custom scripts, etc.), ensure deploymentConfigName is explicitly set.

Example with boto3 create_deployment:

import boto3

codedeploy = boto3.client("codedeploy", region_name="us-east-1")

response = codedeploy.create_deployment(
    applicationName='my-lambda-app',
    deploymentGroupName='my-lambda-dg',
    deploymentConfigName='CodeDeployDefault.LambdaCanary10Percent5Minutes',
    revision={
        'revisionType': 'AppSpecContent',
        'appSpecContent': {
            'content': '...',  # your AppSpec content here
            'sha256': '...'    # optional
        }
    }
)

print("Deployment ID:", response['deploymentId'])

If you share how you invoke deployments today (CodePipeline YAML, CDK, or direct boto3), I can give a targeted snippet for that flow as well.

Using Terraform

resource "aws_codedeploy_deployment_group" "LAMBDA_DEPLOYMENT_GROUP" {
  app_name               = aws_codedeploy_app.LAMBDA_APP.name  # replace with your app resource or string
  deployment_group_name  = "LAMBDA_DEPLOYMENT_GROUP_NAME"      # replace with your deployment group name
  service_role_arn       = "CODEDEPLOY_SERVICE_ROLE_ARN"       # replace with the IAM role ARN CodeDeploy uses

  # This is the key change: move away from the default "AllAtOnce"
  deployment_config_name = "CodeDeployDefault.LambdaLinear10PercentEvery1Minute"

  deployment_style {
    deployment_type   = "BLUE_GREEN"
    deployment_option = "WITH_TRAFFIC_CONTROL"
  }

  blue_green_deployment_config {
    terminate_blue_instances_on_deployment_success {
      action                           = "TERMINATE"
      termination_wait_time_in_minutes = 5
    }

    deployment_ready_option {
      action_on_timeout = "CONTINUE_DEPLOYMENT"
    }
  }

  autoscaling_groups = []

  load_balancer_info {
    target_group_pair_info {
      prod_traffic_route {
        listener_arns = ["PROD_LISTENER_ARN"] # replace or remove if not using ALB/NLB
      }
      test_traffic_route {
        listener_arns = ["TEST_LISTENER_ARN"] # replace or remove if not using a test listener
      }
    }
  }

  # Add your existing trigger_config, alarm_configuration, etc., as needed
}

Changing deployment_config_name is an in-place update and does not force replacement of the deployment group.

For verification, terraform plan should show an in-place update on aws_codedeploy_deployment_group.LAMBDA_DEPLOYMENT_GROUP with deployment_config_name changing from CodeDeployDefault.LambdaAllAtOnce (or the previous value) to CodeDeployDefault.LambdaLinear10PercentEvery1Minute, and no other changes.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Identify the Lambda deployment group used by your build​

2. Change the deployment configuration for the Lambda deployment group​

3. Confirm future builds use the new configuration​

1. Create a custom Lambda deployment configuration​

2. Find your existing Lambda deployment group​

3. Update the deployment group to use the custom config​

4. Ensure your build/pipeline uses this deployment group​

1. Prerequisites​

2. Identify Lambda deployment groups using the default config​

3. Choose a safer deployment configuration​

3a (Optional). Create a custom Lambda deployment configuration​

4. Update deployment groups to use a non‑default config​

5. Ensure future deployments don’t revert to default​